[PATCH v2 0/5] rsa: fix dependency, rename and relocate RSASSA PSS symbols

Quentin Schulz foss+uboot at 0leil.net
Fri Oct 31 18:08:19 CET 2025


While historically signature verification is mostly done for FIT such
FIT_SIGNATURE dependency for signature algorithm makes sense, it isn't
the only kind of file we can verify signatures of. It can also be done
manually with rsa_verify_hash() with an embedded public key.

Considering the impacted code is guarded by RSA_VERIFY, let's make the
symbol depend on that otherwise selecting it without RSA_VERIFY won't do
anything. The FIT_SIGNATURE dependency wasn't also enough before as it
only implied RSA_VERIFY.

Then, simply relocate the RSA SSA PSS padding with the other RSA symbols
in lib/rsa instead of in boot/ and rename it to remove the mention to
FIT.

Finally, add the PSS padding wherever PKCS1.5 padding is specified as
one or the other can be used.

Signed-off-by: Quentin Schulz <quentin.schulz at cherry.de>
---
Changes in v2:
- do not always enable PSS padding, the increase in size is too much,
- added patch renaming the symbol,
- added patch to fix input prompt and dependency on RSA_VERIFY,
- added patch fixing missing PSS in docstring,
- added patch to group SPL_FIT_ symbols together,
- added patch to remove duplicate VPL_FIT symbol,
- Link to v1: https://patch.msgid.link/20251029-rsa-pss-always-v1-1-ad2b652e75aa@cherry.de

---
Quentin Schulz (5):
      boot: fix incorrect dependency of FIT_RSASSA_PSS
      boot: remove duplicate config entry for VPL_FIT
      boot: group SPL_FIT symbols together
      rsa: rename FIT_RSASSA_PSS to RSASSA_PSS and move symbols under lib/rsa
      rsa: update doxygen doc for RSA signature verification to mention PSS

 boot/Kconfig              | 62 ++++++++++++++++-------------------------------
 configs/sandbox_defconfig |  2 +-
 lib/rsa/Kconfig           | 14 +++++++++++
 lib/rsa/rsa-sign.c        |  2 +-
 lib/rsa/rsa-verify.c      |  8 +++---
 tools/Kconfig             |  2 +-
 6 files changed, 42 insertions(+), 48 deletions(-)
---
base-commit: e34d01d23e45e007368685ffa6dfd674b6dd7b17
change-id: 20251029-rsa-pss-always-dbba5c57d913

Best regards,
-- 
Quentin Schulz <quentin.schulz at cherry.de>



More information about the U-Boot mailing list